CVE-2025-27918

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://anydesk.com/en/changelog/windowsRelease Notes
https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdfExploit, Third Party Advisory

Timeline

Published: Nov 6, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-279198.2An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote An CVE-2025-279208.8Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in CVE-2025-279216.1A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be inje CVE-2025-279245.4Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.CVE-2025-279259.8Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.CVE-2025-279265.3In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords tha CVE-2025-279275.3An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.CVE-2025-279295.3Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.CVE-2025-27935.4IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0 CVE-2025-279305.4Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory mon CVE-2025-279316.5An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395. By using a specially crafted CVE-2025-279328.1Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage